Critical severity · published Jul 21, 2022
CVE-2022-0902
ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access
9.8
CVSS
16.9%
EPSS
No
On KEV
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
RMC-100 (Standard) · ABB
before 2105457-037 · source: vendor
RM
RMC-100-LITE · ABB
before 2106229-011 · source: vendor
UD
UDC · ABB
before 2106177-007 · source: vendor
XF
XFCG5 · ABB
before 2105805-016 · source: vendor
XI
XIO · ABB
before 2106198-008 · source: vendor
XR
XRCG5 · ABB
before 2105864-016 · source: vendor
UF
uFLOG5 · ABB
before 2105298-024 · source: vendor
RF
Rmc-100 Firmware · Abb
before 2105457-037 · source: NVD
RF
Rmc-100-lite Firmware · Abb
before 2106229-011 · source: NVD
UF
Udc Firmware · Abb
before 2106177-007 · source: NVD
UF
Uflog5 Firmware · Abb
before 2105298-024 · source: NVD
XF
Xfcg5 Firmware · Abb
before 2105805-016 · source: NVD